IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business.

Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no churn among deployed customers.

Maryland-based IonQ, whose core business is quantum computing, has been building a security arm around post-quantum cryptography and quantum key distribution, technologies intended to replace or supplement encryption that future quantum computers may be able to break. 

The combination addresses what the companies describe as a two-front problem: conventional attacks that operate at machine speed, and the risk that encrypted data could be retained until quantum decryption becomes practical, a concept known as “harvest now, decrypt later.”

“Our customers need to contain attacks today, put AI to work safely, and prepare for quantum risk,” Elisity CEO James Winebrenner wrote in a blog post announcing the deal. 

IonQ Chairman and CEO Niccolo de Masi struck a more urgent note in a release announcing the deal: “Q-Day is coming much faster than predicted,” he said, referencing the point at which quantum computers could break current encryption technology. 

Both governments and the technology industry have accelerated their timelines to adopt post-quantum cryptography over the past few years. This is partly due to a belief among executives in the U.S. quantum sector that Chinese scientists and labs have achieved breakthroughs across several different fields of quantum computing over the past two years.

The Trump administration recently issued an executive order directing federal agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

Winebrenner told CyberScoop those deadlines are easier to set than to meet. Enterprises will hace to start with identifying the information and operations that need protecting, then mapping the identities, communications and cryptographic dependencies that support them.

“You won’t replace every legacy system at once,” he said. The approach is to migrate what can be migrated, test interoperability and operational impact, and tightly control access around systems that need more time. Segmentation helps contain threats, he added, but does not replace the cryptographic upgrades.

Elisity’s planned role in that transition is to connect identity data to cryptographic decision-making. Its roadmap would extend its IdentityGraph product with cryptographic inventory and risk information, allowing customers to rank post-quantum upgrades by business risk.

The deal also reflects how AI agents are reshaping network security. Elisity’s platform already treats AI agents and other non-human identities as subjects of access policy, and the company has joined the Open Secure AI Alliance with priorities that include least-privilege rules for sanctioned agents, containment of agentic threats and control of unsanctioned AI.

Winebrenner identified the hardest unresolved problem in agent control as maintaining trustworthy identity and authorization as an agent’s task, tools and delegated permissions change. “Knowing an agent is approved is only the beginning,” he said. “You need to understand whose authority it is exercising, what it needs to reach right now and when that access should end.” His prescription is least privilege down to the task: “An AI agent should have access only to the resources its task requires, including when it interacts with older infrastructure.”

The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.

UPDATE: 10/12/2026, 4:25 p.m.: This story has been updated with comments from Elisity CEO James Winebrenner.

The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop.

Anthropic researchers used Claude Mythos Preview to find new weaknesses in two cryptographic methods, the company said Tuesday, including one that is being considered by the National Institute of Standards and Technology for both traditional and quantum computing.  

In a blog post detailing the work, the frontier AI company called it a “substantial” research advancement, but also emphasized that neither flaw affects software now in use.

“The attacks described in these two papers are the strongest attacks we have found to date,” the company wrote in the post. 

One of the weaknesses found was in HAWK, a digital signature scheme under review by the NIST as part of a search for encryption methods that could survive attacks from quantum computers. Working with a human researcher, the AI system found a mathematical shortcut, known as a nontrivial automorphism, in the lattice structure (a complex mathematical grid underpinning its security) HAWK relies on.

The discovered weakness cuts HAWK’s effective key strength in half, meaning key sizes would need to double to keep the same level of security. Anthropic said that change would erase much of what made HAWK an appealing candidate in the first place.

Ellen Boehm, senior vice president of strategy and AI innovation at Keyfactor, a digital identity and cryptography management provider, told CyberScoop that research like Anthropic’s proves that the NIST PQC evaluation process is working. 

She also said the research “elevates the importance for organizations to have visibility of where cryptography sits inside their enterprise, what business systems and processes it’s connected to, and the need for PQC readiness, if they haven’t already built a plan.” 

The other flaw was found in a weakened version of the Advanced Encryption Standard, or AES, the cipher NIST adopted in 2001 and the most widely used method for scrambling data in transit. Working largely on its own, Mythos invented a mathematical shortcut dubbed the “Möbius Bridge.” While real-world encryption scrambles data through 10 sequential layers, or “rounds,” researchers regularly study a simplified seven-round test version to measure security margins. In previous theoretical attacks, codebreakers had to check 256 separate values against a memory table, but Mythos created a shortcut that eliminated that lookup process entirely.

Combined with other optimizations, this discovery made the strongest known theoretical attack against seven-round AES 200 to 800 times faster. The attack is purely theoretical: It requires an impossible amount of target data — over 400 octillion messages — and cannot touch the full 10-round encryption protecting everyday software. Additionally, Anthropic pointed out that real-world systems remain completely safe.

Anthropic said it followed standard disclosure practices, notifying HAWK’s designers in June and coordinating public release with a NIST mailing list, and briefing government and industry partners beforehand. It also worked with researchers at ETH Zurich, Tel Aviv University and the University of Haifa to build a shared testing tool, called CryptanalysisBench, meant to let other researchers measure how AI systems perform against a range of ciphers.

The findings come as frontier AI models are being deployed by cybersecurity researchers in order to find vulnerabilities in all kinds of software. In June, intelligence agencies in the Five Eyes alliance warned that advanced AI models capable of wreaking havoc in the cyber domain are “months away.” However, a recent report found that despite the avalanche of bugs being unearthed, the threat level across the internet has not materially changed. 

Anthropic said it expects the same AI capabilities eventually to be applied to systems already in wide use, raising a separate question it said it has not yet resolved: how researchers, companies and governments should respond if a language model uncovers a flaw in a cryptographic system that protects critical infrastructure.

“As we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact,” the company wrote. “We hope that our work here will help launch these conversations.” 

Boehm said work like Anthropic’s further shows that enterprises should not rest on their laurels with any facet of their security apparatus. 

“AI is becoming a powerful tool for many things, including software quality assurance, code development, and in this case cryptographic analysis,” she told CyberScoop. “As AI tools become more widely and continuously used, it just elevates the need for enterprises to treat their trust infrastructure in an ongoing, operational manner versus thinking of it as a static environment that only changes every few years as new cryptographic algorithms are released.”

The post Here’s what Anthropic found when it turned Mythos loose on encryption algorithms appeared first on CyberScoop.